Oracle9i Security Overview

Moran R.

The Oracle9i Security Overview presents the basic concepts of data security in the Internet age. It outlines fundamental data security requirements and explains the risks which threaten the integrity and privacy of your data. Several chapters introduce the rich array of technology that can contribute to system security. The book concludes with a survey of the Oracle features and products which implement these technologies.Together, these products have the potential to control access to all the vulnerable areas of your system, and help users and administrators to perform their tasks without jeopardizing the security plan you have put in place. The Oracle9i Security Overview is intended for database administrators (DBAs), application programmers, security administrators, system operators, and other Oracle users who perform the following tasks:■ Analyze application security requirements■ Create security policies■ Implement security technologies■ Administer enterprise user securityTo use this document, you need general familiarity with database and networking concepts”

---

Table of contents :
Contents……Page 3
Send Us Your Comments……Page 13
Preface……Page 15
Part I Security Challenges……Page 23
1 Data Security Challenges in the Internet Age……Page 25
Top Security Myths……Page 26
The Many Dimensions of System Security……Page 27
Secure Storage of Sensitive Data……Page 29
Integrity……Page 30
Availability……Page 31
Promises and Problems of the Internet……Page 32
Much More Valuable Data……Page 33
Scalability……Page 34
Hosted Systems and Exchanges……Page 35
A World of Data Security Risks……Page 36
Falsifying User Identities……Page 37
Unauthorized Access to Tables and Columns……Page 38
Multitier Systems……Page 39
Scaling the Security Administration of Multiple Systems……Page 40
A Matrix of Security Risks and Solutions……Page 41
The System Security Team……Page 43
Part II Technical Solutions to Security Risks……Page 45
2 Protecting Data Within the Database……Page 47
System Privileges……Page 48
Managing System and Object Privileges……Page 49
Database Roles……Page 50
Global Roles……Page 51
Secure Application Roles……Page 52
Using Network Facilities to Manage Privileges……Page 53
Using Views to Manage Privileges……Page 54
Application Query Rewrite: Virtual Private Database (VPD)……Page 55
Label Based Access Control……Page 56
Industry Standard Encryption Algorithms……Page 57
Database Integrity Mechanisms……Page 58
System Availability Factors……Page 59
Secure Configuration Practices……Page 60
3 Protecting Data in a Network Environment……Page 61
Introduction……Page 62
Native Network Capabilities (Valid Node Checking)……Page 63
Encrypting Data for Network Transmission……Page 64
Encryption Algorithms……Page 65
Secure Sockets Layer (SSL) Protocol……Page 66
Firewalls……Page 67
Java Database Connectivity (JDBC)……Page 68
Thin JDBC Driver……Page 69
4 Authenticating Users to the Database……Page 71
Passwords……Page 72
Strong Authentication……Page 73
RADIUS……Page 74
Token Cards……Page 75
Smart Cards……Page 76
PKI and Certificate-Based Authentication……Page 77
Proxy Authentication and Authorization……Page 78
Server-Based Single Sign-On……Page 80
Middle Tier Single Sign-On……Page 81
5 Using and Deploying a Secure Directory……Page 83
Introduction……Page 84
Centralizing Shared Information with LDAP……Page 85
Directory Authentication of Users……Page 87
Password Protection in a Directory……Page 88
Directory Access Controls and Authorization……Page 89
Authorization of Administrators……Page 90
Administrative Roles in the Directory……Page 94
6 Administering Enterprise User Security……Page 95
Introduction……Page 96
Enterprise Privilege Administration……Page 97
Shared Schemas……Page 98
Multitier Authentication and Authorization……Page 99
Single Sign-On……Page 100
7 Auditing to Monitor System Security……Page 101
Efficient Auditing……Page 102
Fine Grained, Extensible Auditing……Page 103
Auditing in Multitier Application Environments……Page 104
8 The Public Key Infrastructure Approach to Security……Page 105
Security Features of PKI……Page 106
Advantages of the PKI Approach……Page 107
Public Key Cryptography and the Public Key/Private Key Pair……Page 108
Certificate Authorities……Page 109
Certificates……Page 110
Secure Sockets Layer Authentication and X.509v3 Digital Certificates……Page 111
Storing Secure Credentials with PKI……Page 112
Network Security Using PKI……Page 113
Part III Oracle9i Security Products……Page 115
9 Oracle9i Security Products and Features……Page 117
Oracle9i Standard Edition……Page 118
Referential Integrity……Page 119
Privileges……Page 120
Views, Stored Program Units, Triggers……Page 121
User Profiles……Page 122
Data Partitioning……Page 123
Very High Availability with Real Application Clusters……Page 124
Introduction……Page 125
Expanded Credential Proxy……Page 126
Application User Proxy Authentication……Page 127
Deep Data Protection……Page 128
Application Security……Page 129
Virtual Private Database in Oracle8i and Oracle9i……Page 130
How Virtual Private Database Works……Page 131
Application Context in Oracle9i……Page 132
Application Context Initialized Externally……Page 133
Application Context Accessed Globally……Page 134
How Partitioned Fine-Grained Access Control Facilitates VPD……Page 135
Oracle Policy Manager……Page 136
Fine-Grained Auditing……Page 137
SecurityManager Class……Page 139
Oracle Advanced Security……Page 140
Introduction to Oracle Advanced Security……Page 141
Oracle Net Services Native Encryption……Page 143
Checksumming in Oracle Advanced Security SSL……Page 145
JDBC-OCI Driver……Page 146
Thin JDBC……Page 147
Oracle Java SSL……Page 148
Strong Authentication Methods Supported by Oracle Advanced Security……Page 149
Oracle Public Key Infrastructure-Based Authentication……Page 150
RADIUS with Oracle Advanced Security……Page 152
Biometric Authentication with Oracle Advanced Security……Page 153
Distributed Computing Environment (DCE) with Oracle Advanced Security……Page 154
PKI-Based Single Sign-On Configuration……Page 155
Enterprise User Security Features of Oracle Advanced Security……Page 156
Tools for Enterprise User Security……Page 157
Directory Integration……Page 158
Trusted Certificates……Page 159
Oracle Internet Directory……Page 160
PKI Integration and Interoperability……Page 161
Strong Wallet Encryption……Page 162
Oracle PKI Implementation Summary……Page 163
Oracle Label Security……Page 164
Introduction to Oracle Internet Directory……Page 166
LDAP Compliance……Page 168
How Oracle Internet Directory is Implemented……Page 169
Shared Schemas with Oracle Internet Directory……Page 171
Oracle Net on the Database Server……Page 172
Access Control……Page 173
Firewalls Using Oracle Connection Manager in an Intranet Environment……Page 174
Firewalls Using Oracle Net Firewall Proxy in an Internet Environment……Page 175
Valid Node Checking in Oracle Net Services……Page 176
Database Enforced VPD Network Access……Page 177
Oracle HTTP Server……Page 178
Web SSO Technology……Page 179
PKI Support……Page 180
Oracle Single Sign-On Summary……Page 181
Index……Page 183